CVE-2022-30521
 
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
The LAN-side Web-Configuration Interface has Stack-based Buffer Overflow vulnerability in the D-Link Wi-Fi router firmware DIR-890L DIR890LA1_FW107b09.bin and previous versions. The function created at 0x17958 of /htdocs/cgibin will call sprintf without checking the length of strings in parameters given by HTTP header and can be controlled by users easily. The attackers can exploit the vulnerability to carry out arbitrary code by means of sending a specially constructed payload to port 49152.
La interfaz de configuración web del lado de la LAN presenta una vulnerabilidad de desbordamiento de búfer en la región Stack de la memoria en el firmware del router Wi-Fi D-Link DIR-890L versiones DIR890LA1_FW107b09.bin y anteriores. La función creada en 0x17958 de /htdocs/cgibin llama a sprintf sin comprobar la longitud de las cadenas en los parámetros dados por el encabezado HTTP y puede ser controlada por los usuarios fácilmente. Los atacantes pueden explotar la vulnerabilidad para realizar código arbitrario mediante el envío de una carga útil especialmente construida al puerto 49152
CVSS Scores
SSVC
- Decision:-
Timeline
- 2022-05-09 CVE Reserved
- 2022-05-27 CVE Published
- 2024-08-03 CVE Updated
- 2024-08-03 First Exploit
- 2024-08-18 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-787: Out-of-bounds Write
CAPEC
References (3)
URL | Tag | Source |
---|---|---|
https://github.com/winmt/my-vuls/tree/main/DIR-890L |
URL | Date | SRC |
---|---|---|
https://github.com/winmt/CVE/blob/main/DIR-890L/README.md | 2024-08-03 |
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://www.dlink.com/en/security-bulletin | 2023-08-01 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Dlink Search vendor "Dlink" | Dir-890l Firmware Search vendor "Dlink" for product "Dir-890l Firmware" | <= 1.07b09 Search vendor "Dlink" for product "Dir-890l Firmware" and version " <= 1.07b09" | - |
Affected
| in | Dlink Search vendor "Dlink" | Dir-890l Search vendor "Dlink" for product "Dir-890l" | - | - |
Safe
|